ASP.NET人员信息更新功能失效问题求助

问题场景 #

在ASP.NET项目中实现PersonelBilgileri表的更新功能：选中表格数据点击更新后，数据能正常显示在编辑页面，但修改数据后点击更新按钮，更新操作无法执行。

相关代码 #

更新按钮点击事件代码 #

protected void btnGuncelle_Click(object sender, EventArgs e)
{
    string sorgu = "UPDATE PersonelBilgileri set Ad=@Ad,Soyad=@Soyad,DogumTarihi=@DogumTarihi,Telefon=@Telefon,TcNo=@TcNo,Maas=@Maas,GirisTarihi=@GirisTarihi,CikisTarihi=@CikisTarihi WHERE PersonelID=" + Application["PersonelId"].ToString() + "";
    SqlCommand cmd = new SqlCommand();
    cmd.Parameters.AddWithValue("@Ad", txtAd.Text);
    cmd.Parameters.AddWithValue("@Soyad", txtSoyad.Text);
    cmd.Parameters.AddWithValue("@DogumTarihi", txtDogumTarihi.Value);
    cmd.Parameters.AddWithValue("@Telefon", txtTelefon.Text);
    cmd.Parameters.AddWithValue("@TcNo", txtTcNo.Text);
    cmd.Parameters.AddWithValue("@Maas", txtMaas.Text);
    cmd.Parameters.AddWithValue("@GirisTarihi", txtGirisTarihi.Value);
    cmd.Parameters.AddWithValue("@CikisTarihi", txtCikisTarihi.Value);  
    Class1.EkleSilGuncelle(cmd,sorgu);
    Response.Redirect("WebForm1");        
}

EkleSilGuncelle方法代码 #

public static void EkleSilGuncelle(SqlCommand cmd, string sql)
{
    SqlConnection baglanti = new SqlConnection(WebConfigurationManager.ConnectionStrings["StajConnectionString"].ConnectionString);
    baglanti.Open();
    cmd.Connection = baglanti;
    cmd.CommandText = sql;
    cmd.ExecuteNonQuery();
    baglanti.Close();
    cmd.Dispose();
    baglanti.Dispose();
}

加载选中数据到编辑页面的代码 #

int id = int.Parse(Application["PersonelId"].ToString());
Class1.KayitGetir(txtPersonelID, txtAd, txtSoyad, txtDogumTarihi, txtTelefon, txtTcNo, txtMaas, txtGirisTarihi, txtCikisTarihi,id);

KayitGetir方法代码 #

public static void KayitGetir(TextBox PersonelID, TextBox Ad, TextBox Soyad, HtmlInputGenericControl DogumTarihi,TextBox Telefon,TextBox TcNo,TextBox Maas, HtmlInputGenericControl GirisTarihi, HtmlInputGenericControl CıkısTarihi, int personelId)
{
    SqlConnection baglanti = new SqlConnection("Data Source = ; Initial Catalog = ; User ID = ; Password = ");
    baglanti.Open();
    SqlCommand cmd = new SqlCommand("select * from PersonelBilgileri where PersonelID='"+personelId.ToString()+"'", baglanti);
    SqlDataReader dr = cmd.ExecuteReader();
    while(dr.Read()){
        PersonelID.Text = dr[0].ToString();
        Ad.Text = dr[1].ToString();
        Soyad.Text = dr[2].ToString();
        DogumTarihi.Value = ((DateTime)dr[3]).ToString("yyyy-MM-dd");
        Telefon.Text = dr[4].ToString();
        TcNo.Text = dr[5].ToString();
        Maas.Text = dr[6].ToString();
        GirisTarihi.Value = ((DateTime)dr[7]).ToString("yyyy-MM-dd");
        CıkısTarihi.Value = ((DateTime)dr[8]).ToString("yyyy-MM-dd");
    }
    dr.Close();
    cmd.Dispose();
    baglanti.Close();
    baglanti.Dispose();   
}

问题排查与修复方案 #

1. 修复WHERE子句的参数化问题 #

当前更新语句直接拼接Application["PersonelId"]到SQL字符串，存在SQL注入风险，且可能因类型不匹配导致更新条件失效。需将PersonelID改为参数化传递：

// 修改更新语句
string sorgu = "UPDATE PersonelBilgileri set Ad=@Ad,Soyad=@Soyad,DogumTarihi=@DogumTarihi,Telefon=@Telefon,TcNo=@TcNo,Maas=@Maas,GirisTarihi=@GirisTarihi,CikisTarihi=@CikisTarihi WHERE PersonelID=@PersonelID";
// 添加PersonelID参数
cmd.Parameters.AddWithValue("@PersonelID", Application["PersonelId"].ToString());

2. 替换Application对象为Session #

Application是全局共享对象，多用户操作时会覆盖PersonelId导致更新错误，改用Session存储当前编辑ID：

• 传递ID时：Session["PersonelId"] = 选中的ID值;
• 读取ID时：int id = int.Parse(Session["PersonelId"].ToString());
• 更新按钮中：cmd.Parameters.AddWithValue("@PersonelID", Session["PersonelId"].ToString());

3. 修复数据类型转换问题 #

• 若Maas是数值类型，需转换为对应类型（如decimal）：

  cmd.Parameters.AddWithValue("@Maas", decimal.Parse(txtMaas.Text));
  

• 日期字段转换为DateTime类型传递，避免格式问题：

  cmd.Parameters.AddWithValue("@DogumTarihi", DateTime.Parse(txtDogumTarihi.Value));
  cmd.Parameters.AddWithValue("@GirisTarihi", DateTime.Parse(txtGirisTarihi.Value));
  cmd.Parameters.AddWithValue("@CikisTarihi", DateTime.Parse(txtCikisTarihi.Value));
  

4. 修复KayitGetir方法的连接字符串 #

KayitGetir中硬编码空连接字符串，改为读取配置文件中的连接字符串：

SqlConnection baglanti = new SqlConnection(WebConfigurationManager.ConnectionStrings["StajConnectionString"].ConnectionString);

5. 添加异常处理与资源释放 #

使用using语句自动释放数据库连接，添加异常捕获方便排查问题：

public static void EkleSilGuncelle(SqlCommand cmd, string sql)
{
    using (SqlConnection baglanti = new SqlConnection(WebConfigurationManager.ConnectionStrings["StajConnectionString"].ConnectionString))
    {
        try
        {
            baglanti.Open();
            cmd.Connection = baglanti;
            cmd.CommandText = sql;
            int affectedRows = cmd.ExecuteNonQuery();
            // 可通过affectedRows判断是否有数据被更新
        }
        catch (Exception ex)
        {
            // 记录异常日志，便于排查
            throw;
        }
    }
}

内容的提问来源于stack exchange，提问作者theenes